fix: settle 0.x memory hardening and security backlog

[codegiveness]

Authorized scope

Maintainer requests reachable PR/issue and security/quality settlement, explicitly continuing 0.x only. No 1.x release is authorized. Oh My Pi/OpenCode production success is recorded as user-reported evidence, not invented 30-day or other-harness certification.

Fixes #55
Fixes #56
Fixes #52

Implementation

• Corrected memory-hardening specifications; conservative JSON accounting and explicit early-stop truncation metadata; bounded XML-compatible SHOWPLAN reading and structured PLAN_TOO_LARGE with recovery advice. All callers migrated; disabled caps preserved.
• Integrates accepted dependency changes from chore(deps): Bump Microsoft.Extensions.Logging.Abstractions and 2 others #137/chore(deps): Bump Microsoft.Extensions.Options from 10.0.11 to 10.0.12 #138/chore(deps): Bump Microsoft.Extensions.Hosting and Microsoft.Extensions.Logging.Console #135/chore(deps): Bump Microsoft.Data.SqlClient from 7.0.2 to 7.1.1 #134/chore(deps): Bump coverlet.collector from 10.0.1 to 10.1.0 #133/chore(deps): Bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 #132 together, eliminating the observed dependency downgrade. chore(deps): Bump dotnet/runtime-deps from 10.0-alpine-amd64 to 11.0-alpine-amd64 #129 was deliberately declined; Docker remains on .NET 10.
• Digest-pinned Docker images and genuine hashed portable/six-RID NuGet locks, including referenced projects. Fresh canonical-registry regeneration fixes a real NU1403 caused by the Ubuntu SDK's repackaged ILLink artifact; hash validation is not disabled.
• A real container SQL/MCP smoke exposed invariant-globalization failure despite successful --version. The ICU-enabled .NET 10 Alpine image fixes it; CI now validates SQL inside the container against a pinned SQL Server 2022 service.
• C#/JS CodeQL and actual SharpFuzz/libFuzzer CI; offline npm native-package verification; authoritative synchronization of all five platform stamps; release guards block major >=1 and malformed/injection tags.
• Retires superseded v1 trackers Wayfinder map: v1.0 launch readiness #1/Spec: v1.0.0 launch readiness #11/Dogfood 30 days — daily production use (HITL) #20/Tag v1.0.0-rc.1 → 7-day promotion gate → tag v1.0.0 (HITL) #22/Harness Verification Records for 6 harnesses #34 without falsely certifying their old criteria. Documents external badge, genuine independent-review, and maintenance-history prerequisites rather than fabricating them.
• Replaces obsolete source-text security checks with behavior-level redirect rejection/depth regression checks.

Observed local acceptance

• Build: zero warnings/errors. Unit run: 439 passed, 0 failed, 4 pre-existing unreachable-case skips.
• Full opt-in run against disposable SQL Server: 464 passed, 0 failed, the same 4 skips; actual integration tests now run. No production database was used.
• Formatting and actual C# LSP diagnostics: zero errors; the nonshipping fuzz project was separately loaded and checked.
• CLI validate/help/unknown argument; official MCP Inspector handshake, 9 tools, live list_databases, idempotency annotations: pass.
• Real MCP reader boundaries, null/Unicode accounting, disabled caps, raw XML refusal/recovery and usable subsequent session: pass. Published trimmed linux-x64 binary and built Alpine container actually queried SQL Server.
• Locked restore/publish of all six runtime profiles and NuGet pack: pass. Other OS builds were cross-published, not executed.
• Actual fresh offline npm main/native installs resolved matching 0.5.5 local archives and ran the built binary. Main-only/no-download install produced expected exit 1 and actionable alternatives.
• Release/version suites, README snippets/badge URLs, npm smoke and behavioral security regressions, actionlint workflow schema: pass.
• Actual managed crash-detection probe: detected separately. Real 10-second fuzz campaign: 52,661 inputs/11 seconds, feature count 3,191→14,456, corpus 4→867, 0 real findings. This is bounded evidence, not exhaustive security proof.

Settlement gate

Inspect the hosted CI, CodeQL and fuzz executions before merge; inspect Scorecard on merged main before any alert disposition. Then close the six original dependency PRs as incorporated/superseded by this PR, with evidence links. Remaining genuine human/external prerequisites stay visible. Details: docs/security-quality-follow-up.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codegiveness]

Verification evidence is now committed in docs/security-quality-follow-up.md and the corrected draft assessment. Original-head hosted CI, C#/JS CodeQL and fuzz all passed; uploaded CodeQL records had 0 results and empty errors/warnings (C# resolved 283 references, unresolved 0). Downloaded hosted fuzz artifacts show 370,328 inputs in 61 seconds, features 3,191→22,137, corpus 4→1,706; the separate crash probe succeeded and no genuine campaign findings were emitted. Isolated merged Core/Tools coverage measured 85.37% line / 73.69% branch, not whole-repository coverage. After the documentation update, local unit/live-SQL acceptance passed again: 439 / 464 successful tests, 0 failures, four existing skips; CLI validation, format, npm/readme/version checks and the official MCP stdio smoke passed. Waiting for the latest-head checks before merge, then inspecting fresh main Scorecard before alert disposition. External badge review/submission remains #140; independent human review and maintenance history are not fabricated.